xwiki-contrib/application-discussions · Security
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
- GHSA ID
- GHSA-4j38-rw27-97gx
- CVE ID
- CVE-2023-37465
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
Impact
It's possible to forge a request to delete a message.
Patches
The problem has been patched in version 2.0-rc-1 of Discussion Extension.
Workarounds
There's no easy workaround except upgrading.
References
https://jira.xwiki.org/browse/DISCUSSION-22
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki
- Email us at security mailing-list
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)